🇩🇪
Bedios GmbH
2026-05-01 07:59:06
(1 month ago)
Wordpress hacking attempt
Web App Attack
🇺🇸
SodaAudit.app
2026-04-30 18:02:14
(1 month ago)
[sodaaudit.app] Web app attack. Timestamp: 2026-04-30T17:41:48.000Z. 2 probe events, 1 distinct path ...
show more
[sodaaudit.app] Web app attack. Timestamp: 2026-04-30T17:41:48.000Z. 2 probe events, 1 distinct path(s). Paths (payload): /xmlrpc.php
show less
Web App Attack
🇩🇪
LRob.fr
2026-04-30 15:30:19
(1 month ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇺🇸
integrantservices.com
2026-04-29 17:16:20
(1 month ago)
(wordpress) Failed wordpress login from 27.131.210.136 (IN/India/ns0.wishnet.in)
Brute-Force
🇦🇺
QT
2026-04-29 06:46:22
(1 month ago)
Unauthorised WordPress admin login attempted at 2026-04-29 16:46:14 +1000
Web App Attack
🇺🇸
TPI-Abuse
2026-04-29 00:04:54
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 27.131.210.136 (ns0.wishnet.in): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 27.131.210.136 (ns0.wishnet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 20:04:47.502156 2026] [security2:error] [pid 20481:tid 20481] [client 27.131.210.136:61552] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||krystalsgiftshopandboutique.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "krystalsgiftshopandboutique.net"] [uri "/wp-json/wp/v2/users"] [unique_id "afFLH75CqcHMJSab49yrCwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-28 16:09:06
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 27.131.210.136 (ns0.wishnet.in): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 27.131.210.136 (ns0.wishnet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 12:08:58.484478 2026] [security2:error] [pid 1929:tid 1929] [client 27.131.210.136:61858] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||asapstarsmogcheck.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "asapstarsmogcheck.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afDbmu4Sp-XsEzlZPlvytwAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-28 15:40:55
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 27.131.210.136 (ns0.wishnet.in): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 27.131.210.136 (ns0.wishnet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 11:40:50.971308 2026] [security2:error] [pid 19376:tid 19376] [client 27.131.210.136:56907] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||67ronin.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "67ronin.com"] [uri "/wp-json/wp/v2/users"] [unique_id "afDVApfId-35-HvN_ZcwXQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-26 12:34:45
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 27.131.210.136 (ns0.wishnet.in): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 27.131.210.136 (ns0.wishnet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 08:34:39.584126 2026] [security2:error] [pid 3415:tid 3415] [client 27.131.210.136:54838] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||microkerneltechnologies.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "microkerneltechnologies.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ae4GXxKYh6_sQ1rp7cY1SwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
octageeks.com
2026-04-26 04:15:58
(1 month ago)
Wordpress malicious attack:[octaxmlrpc]
Web App Attack
🇦🇺
screwlooseit.com.au
2026-04-25 15:43:57
(1 month ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
IN/India/ns0.wishnet.in
Web App Attack
🇺🇸
TPI-Abuse
2026-04-25 14:56:28
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 27.131.210.136 (ns0.wishnet.in): 1 in the last ...
show more
(mod_security) mod_security (id:225170) triggered by 27.131.210.136 (ns0.wishnet.in): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 25 10:56:22.984331 2026] [security2:error] [pid 26502:tid 26502] [client 27.131.210.136:54550] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||feiz.church|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "feiz.church"] [uri "/wp-json/wp/v2/users"] [unique_id "aezWFqTOICJiqMFfDJLe8AAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
wlt-blocker
2026-04-23 00:40:53
(1 month ago)
Unauthorized access to webpage admin
Web App Attack
🇺🇸
mnsf
2026-04-18 00:20:12
(1 month ago)
Xmlrpc Caught (6)
Brute-Force
Web App Attack
🇺🇸
raymarron.com
2026-04-18 00:12:19
(1 month ago)
/xmlrpc.php
POST /xmlrpc.php
Web App Attack